14 DAY TRIAL // Microsoft has released the October 2019 Patch Tuesday updates to resolve a total of 59 vulnerabilities in its software, out of which just 9 are considered to be “critical.”
Interestingly, out of these 9 flaws, no less than 7 impact browsers and scripting engines, including Internet Explorer and Microsoft Edge.
Of particular attention this month is an elevation of privilege vulnerability in the Windows Error Reporting manager, with the proof of concept already published online.
While Microsoft says the bug isn’t exploited in the wild, the company explains that a successful an attack can get the rights to overwrite a targeted file, eventually obtaining elevated status. A successful attack requires the attack to log in to the system, and using a crafted application, a malicious actor can take control of the affected system.
“The security update addresses the vulnerability by correcting how Windows Error Reporting manager handles hard links,” Microsoft explains in CVE-2019-1315.
Patching recommended ASAP
There’s also a remote code execution vulnerability in Remote Desktop Client, and Microsoft says in CVE-2019-1333 it’s not aware of any attacks happening in the wild.
With a “critical” severity rating, the flaw can allow an attack to install programs, and even create new accounts with full administrator rights.
“To exploit this vulnerability, an attacker would need to have control of a server and then convince a user to connect to it. An attacker would have no way of forcing a user to connect to the malicious server, they would need to trick the user into connecting via social engineering, DNS poisoning or using a Man in the Middle (MITM) technique. An attacker could also compromise a legitimate server, host malicious code on it, and wait for the user to connect,” Microsoft explains.
All security patches are included in the cumulative updates shipped to Windows 10 devices and the monthly rollups aimed at Windows 7 and Windows 8.1 computers.